Control unit and method of making the same

ABSTRACT

A temperature regulating control unit and method of making the same are provided, the unit comprising a RTD temperature sensor, a unit for applying electrical signals to the sensor, and a microcomputer for receiving digital signals from the sensor in relation to the temperature being sensed by the sensor, the unit for applying electrical signals to the sensor applying a varying voltage to the sensor.

CROSS REFERENCE TO RELATED APPLICATION

This application is a divisional patent application of its copendingparent patent application, Ser. No. 939,872, filed Dec. 10, 1986.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a new control unit and a new method of makingthe control unit, the control unit being particularly adapted to beutilized for controlling the operation of a cooking apparatus or thelike.

2. Prior Art Statement

It is known to provide a temperature regulating control unit comprisinga RTD temperature sensor, means for applying electrical signals to thesensor, and a microcomputer for receiving digital signals from thesensor in relation to the temperature being sensed by the sensor, themeans for applying electrical signals to the sensor applying constantcurrent to the sensor.

It is also known to provide a control unit comprising a high energycontrol circuit means having an output relay driver transistor, manuallyoperated means for initiating the operation of the high energy controlcircuit means, microcomputer means for operating the high energy controlcircuit means after the manually operated means has initiated theoperation thereof, and supervisory circuit means for detecting dynamicfailure of the microcomputer means and disabling the high energy controlcircuit means if the microcomputer means is not operating in a normalmode thereof, the supervisory circuit means having means requiring themanual operation of the manually operated means before permitting powerto reach the high energy control circuit means whereby the high energycircuit means is disabled unless the manual operation of the manuallyoperated means has taken place and the microcomputer means is operatingin the normal mode thereof. For example, see the Fowler, U.S. Pat. No.4,611,295.

SUMMARY OF THE INVENTION

It is a feature of this invention to provide a new temperatureregulating control unit that is less costly any requires fewer and lesscritical components than prior known temperature regulating controlunits that utilize a constant current to excite the sensor.

In particular, it was found according to the teachings of this inventionthat an RTD temperature sensor can have a varying voltage appliedthereto and such temperature sensor can be utilized to apply digitalsignals to a microcomputer in relation to the temperature being sensedby the sensor.

For example, one embodiment of this invention provides a temperatureregulating control unit comprising an RTD temperature sensor, means forapplying electrical signals to the sensor, and a microcomputer forreceiving digital signals from the sensor in relation to the temperaturebeing sensed by the sensor, the means for applying electrical signals tothe sensor applying a varying voltage to the sensor.

It is another feature of this invention to provide a control unit havinga unique supervisory circuit means for monitoring the high energycontrol circuit means thereof.

In particular, it was found according to the teachings of this inventionthat a comparator of a prior known supervisory circuit means could beeliminated and that a supervisory transistor of the supervisory circuitmeans could be disposed in series with the output relay drivertransistor of the high energy control circuit means with the requirementthat the supervisory transistor must be switched on to enable the relaydriver transistor.

For example, another embodiment of this invention provides a controlunit comprising a high energy control circuit means having an outputrelay driver transistor, manually operated means for initiating theoperation of the high energy control circuit means, microcomputer meansfor operating the high energy control circuit means after the manuallyoperated means has initiated the operation thereof, and supervisorycircuit means for detecting dynamic failure of the microcomputer meansand disabling the high energy control circuit means if the microcomputermeans is not operating in a normal mode thereof, the supervisory circuitmeans having means requiring the manual operation of the manuallyoperated means before permitting power to reach the high energy controlcircuit means whereby the high energy control circuit means is disabledunless the manual operation of the manually operated means has takenplace and the microcomputer means is operating in the normal modethereof, the supervisory circuit means having a supervisory transistortherein that is in series with the relay driver transistor and that mustbe switched on to enable the relay driver transistor.

Accordingly, it is an object of this invention to provide a new controlunit having one or more of the novel features of this invention as setforth above or hereinafter shown or described.

Another object of this invention is to provide a new method of makingsuch a control unit, the method of this invention having one or more ofthe novel features of this invention as set forth above or hereinaftershown or described.

Other objects, uses and advantages of this invention are apparent from areading of this description which proceeds with reference to theaccompanying drawings forming a part thereof and wherein:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic front view of a control unit of this invention.

FIG. 2 is a block diagram illustrating the various circuit sections ofthe electrical circuit means of the control unit of FIG. 1 in block formand illustrates how the electrical circuit means is interconnected toexternal components to operate the same.

FIG. 3 is a block diagram illustrating how FIGS. 4A, 4B, 4C and 4D areto be arranged in order to illustrate the entire circuit means of thecontrol unit of FIG. 1.

FIGS. 4A, 4B, 4C and 4D respectively illustrate parts of the entireelectrical circuit means of the control unit of FIG. 1. FIGS. 4A-4Dbeing adapted to be arranged in the manner illustrated in FIG. 3 toprovide the entire circuit means for the control unit of FIG. 1.

FIG. 5 is a fragmentary view of part of the internal circuit means of acustom network that is illustrated in FIG. 4A and forms of the maincircuit means of the control unit of FIG. 1.

FIG. 6 is a bar graph that illustrates the clean mode temperature actionpoints of the control unit of FIG. 1.

FIG. 7 is a bar graph that illustrates the broil mode temperature actionpoints of the control unit of FIG. 1.

FIG. 8 is a bar graph that illustrates the bake mode temperature actionpoints of the control unit of FIG. 1.

FIG. 9 is a bar graph that illustrates the formation of the heatingelement relay T-on and T-off temperatures of the control unit of FIG. 1.

FIG. 10 is a bar graph that illustrates the bake mode first temperaturerise compensation action points of the control unit of FIG. 1.

DESCRIPTION OF THE PREFERRED EMBODIMENT

While the various features of this invention are hereinafter illustratedand described as being particularly adapted to provide a control unitfor controlling a domestic cooking oven or the like, it is to beunderstood that the various features of this invention can be utilizedsingly or in any combination thereof to provide a control unit forcontrolling other apparatus or appliances as desired.

Therefore, this invention is not to be limited to only the embodimentillustrated in the drawings, because the drawings are merely utilized toillustrate one of the wide variety of uses of this invention.

Referring now to FIG. 1, the new control unit of this invention isgenerally indicated by the reference numeral 20 and comprises a framemeans 21 having a visual display means 22, such as the well known vacuumfluorescent display means as set forth in the U.S. Pat. No. 4,568,927,to Fowler, and a user interface means 23 that comprise a rotary switch24, such as one of the rotary switches as set forth in the U.S. Pat. No.4,625,084, to Fowler, et al., and eight momentary contact push buttonsS1, S2, S3, S4, S5, S6, S7 and S8 of conventional design that remain ina normally open condition when released and therefore must be heldclosed by the user in a manner well known in the art whereby theaforementioned two U.S. Pat. Nos. 4,568,927 and 4,625,084, are beingincorporated into this disclosure by the reference thereto.

The control unit 20 is a solid state, microcomputer based device capableof providing several advanced functions for home use, self-cleaningovens. When used in conjunction with the appropriate temperature sensorand power interface circuitry, the control unit 20 provides thefollowing main functions: Time of Day Clock; Minute Timer with Alarm;Control of Oven Temperature in Bake, Broil, and Self-clean modes;Automatic Self-clean Mode; Delay Start of Clean and Bake Modes; andTimed Bake Modes. Data entry is accomplished with th eight function keysS1-S8 in conjunction with the rotary switch 24. The user selects afunction with one of the keys S1-S8 and then enters data via the rotaryswitch 24, in the manner fully set forth in the aforementioned patents.Information is displayed to the user by means of the vacuum fluorescentdisplay 22. Time and oven temperature information is displayedsimultaneously. The display 22 is color coded for ease of identificationwith time information being blue-green and temperature information beingred.

The control unit 20 has an electrical circuit means therein which isgenerally indicated by the reference numeral 25 in FIGS. 2 and 4, thecircuit means 25 being schematically illustrated by the dashed block 26in FIG. 2 and containing sections of the electrical circuitry 25 asblocks 27, 28, 29, 30, 31, 32, 33, 34, 35, 36 and 37.

The block 27 comprises the electrical power supply for the control unit20 and is adapted to be interconnected to an external power supply 38,FIG. 2, which comprises a Class 2, A.C. input and which in one workingembodiment of the invention is 21 VAC, 50/60 hz, the outputs of thepower supply block 26 for the circuit 25 being -VR, -VFD, VDD and VGG.

The block 28 comprises a 60 hz reference generator to provide the realtime reference signal utilized by the control unit 20 and the block 29comprises a power on reset to provide a reset state for the control unitwhenever insufficient voltage is available to properly power the controlunit 20.

The block 30 is an A/D converter and is adapted to be interconnected toan external RTD temperature sensor 39 for the oven (not shown) of thecooking apparatus (not shown) using the control unit 20.

The block 31 is the user interface means of the circuitry 25 thatcontains the eight push buttons on keys S1-S8 and the rotary switch 24.

The block 32 comprises a microcomputer that is hereinafter referred toas U2 in this description and in FIG. 4 of the drawings, themicrocomputer being conventional in the art and being programmed tofunction in a manner hereinafter set forth.

The block 33 comprises the display means 22.

The block 34 comprises a conventional EEPROM and is a sixteen by sixteenbit device that is hereinafter referred to as U3 in this description andin FIG. 4 of the drawings.

The block 35 comprises a free running oscillator U1 whose frequency is anominal 2.45 KHZ and drives a piezoelectric speaker Y1.

The block 36 comprises an oven interface means that has three outputsand a software monitored input from an externally interconnectedself-clean door lock mechanism 40, the outputs activating externallyinterconnected relays (not shown) which, in turn, respectively activatethe oven bake element and oven broil element as well as a down draft fanof required that are schematically indicated by the external block 41 ofFIG. 2.

The two outputs of the block 36 that control the heating elements mustpass current through the block 37 prior to enabling the element relays,the block 37 comprising a watchdog circuit that supplies redundantcontrol of the heating elements by requiring a mechanical key closureprior to allowing power to reach the relays that control the heatingelements in a manner hereinafter set forth.

The power supply block 27 is of conventional construction as illustratedin FIG. 4A and provides the following voltages.

The -VFD supply is a source of approximately -27 volts D.C. It isunregulated and supplies the vacuum fluorescent display 22 plus the -15volt regulator. Diodes D3 and D5 and capacitor C4 are the primarycomponents, forming a half-wave, capacitive input circuit. Capacitor C2provides a RFI/EMI decoupling function. The large, 1000 mfd. value ofcapacitor C4 is required because of the long power interruptionwithstand requirement placed on this design. Sufficient energy must bestored to allow continued microcomputer operation, without reset, for atleast 4 seconds after power is removed. To improve this ability stillfurther, diode D2 also couples energy from the 470 mfd capacitor C2 inthe -VR supply in the event of a power dip. This has practical valueonly if the relay outputs are off at the time of power interruption. Dueto the configuration of diodes D1-D5, the -VFD supply is independent ofthe -VR supply. The two supplies are charged from opposite phases of theincoming A.C. voltage. This minimizes voltage fluctuations as loadschange and balances the load placed on the power transformer.

The -VR supply is of similar configuration to the -VFD supply. Itspurpose is to provide power for external D.C. relays, having 24 VDCcoils. The components comprising this circuit are diodes D1 and D4,capacitor C1 and the external Class 2 power transformer 38. It willprovide approximately -24 VDC when loaded with 80 ma. of coil currentfrom the relays. This supply is developed separate of the -VFD supply toprovide failure isolation and from the logic supplies which aredeveloped from -VFD.

The -VGG supply provides a source of low current, -15 volts DC,regulated. It consists of resistors R6 and R2, transistor Q1 and zenordiode Z1. Unregulated -27 VDC from the -VFD supply is applied to thecollector of transistor Q1 through current limit resistor R6. The baseof transistor Q1 is tied to the junction of resistor R2 and diode Z1,which form a voltage divider producing a stable 15.6 VDC derived fromthe -VFD supply. The circuits being powered by this supply become theemitter resistor for transistor Q1, whose current gain provides a stablesource of voltage that is 0.6 VDC lower (due to the Vbe drop oftransistor Q1) than the reference voltage provided by diode Z1. Hence, asource of -15 VDC which maintains its voltage under varying loadconditions is created. The main purpose of this supply is to provideproper power and regulation for use by the A/D circuitry which decodesoven temperature. It is also used as a preregulator for the -VDD supply,which powers the microcomputer U2.

The -VDD supply works on the same principal as the -VGG supply. Itconsists of resistor R3, transistor Q2 and zenor diode Z2. Its input isthe -VGG supply and its output is -5 VDC. This supply powers themicrocomputer U2 and EEPROM U3. It is especially stable due to the inputsource already being a regulated voltage.

The 60 Hz reference generator circuit 28 provides the real timereference signal used by the microcomputer U2 to generate accurate Timeof Day Clock, Timer and other functions requiring consistent real timeresponse. It is basically an inverting, single transistor amplifier,driven to saturation by a signal derived from the AC power line. Thissignal is taken directly from the Class 2 power source 38. It isconditioned through a low pass filter to prevent errors due toelectrical noise on the AC line, before being applied to the base oftransistor Q3. The filter consists of resistances R7 and R10, capacitorC5 and resistor R11. Transistor Q3 inverts and squares up the incomingsinusoidal waveform before applying the resulting square wave signal topin 23 of the microcomputer U2. Resistor R13 is merely a pull-downresistor allowing the collector of transistor Q3 to swing between 0 and-5 V. Capacitor C13's function is to decouple radiated RFI, which couldupset timing accuracy if not suppressed. Since failure of this circuitwould result in the microcomputer U2 losing its capability to keepaccurate time, it is supervised in software. Inhibiting this signal willresult in the error code -F6- being displayed, and an audible alarm tosound, with all outputs shut down.

The power on reset functional block 29 provides a single pulse that isapplied to pin 49 of the microcomputer U2 which is the reset input ofthe microcomputer U2. Its function is to provide monitoring of the -VFDsupply and to place the microcomputer U2 in a reset state wheneverinsufficient voltage is available to properly power the device. It doesthis by driving pin number 49 high under insufficient voltageconditions, which is the reset state of this input. Resistors R1 and R5form a voltage divider placing 27.7% of the instantaneous -VFD supplyvoltage on pin 12 of op amp U1. The other input to pin 13 of the op ampU2 is tied to the -VDD (-5 V.) supply, through impedance matchingresistor R8. After power is applied to the control, the -VFD supplyvoltage rises at a rate dependent on the value of capacitor C4 and thecharacteristic impedance of the external power transformer 38. Theoutput at pin 14 of U1 is in a high state initially because the divideraction on its (+) input slows the rate of voltage rise compared to its(-) input. Upon reaching approximately 18 VDC, the voltage at the (+)input of pin 12 of the op amp U1 becomes more negative than the (-)input pin 13 which is tied to the -5 volt supply. This causes the outputpin 14 of the op amp U1 to switch to a lw output condition. Diode D6provides a latching action by pulling the (+) input greatly negativeonce the output has switched to a low state. This latching actionprevents oscillation of the circuit at borderline trigger voltages. Italso provides hysterisis action which avoids resetting the microcomputerU2 until just before the -5 volt supply falls out of regulation. Thisdelays the decision to reset from a powered state as long as possible toallow the 4 second power loss withstand capability. Resistors R9 and D23form a level shift circuit to protect the 5 volt reset input of themicrocomputer U2 from the 15 volt output swing of the op amp U1. Theresistor R4 is a pull-up resistor for the op amp U1 which assures properlogic levels and initial state of U1's output.

The temperature sensing circuit 30 of this invention improves upon theprior known circuits in several ways.

For example, a ramping voltage, rather than a constant current, is usedto excite the sensor 39. This creates a less costly, yet accuratearrangement, requiring fewer and less critical components. The circuit30 is also insensitive to power supply variations, allowing thatcircuitry to also be less complex. Also, through software logic, circuitfaults that could produce temperature sensing errors of a troublesomemagnitude may be detected and acted upon by the microcomputer U2 of thisinvention. When used as a temperature controller, the circuit 30 mayshut down a heat source and sound an alarm when the device's ability tocontrol temperature accurately is jeopardized. In addition, the dynamicrange of the circuit is expanded due to the method of interface from theD/A converter 30 to the sensor 39. All counts of the 256 bit A/D areusable because the circuit 30 avoids applying voltages to the op amp U1that would exceed its common mode input range. This is achieved withoutexpensive power supply additions. Calibration is also performed withoutmoving parts or potentiometers and the method is electronic.

The A/D circuit 30 works in conjunction with the microcomputer U2 todecode the sensor resistance reading into a digital format, which maythen be processed using digital techniques to sense temperature. The A/Dfunction is actually achieved by a D/A technique first, which is thendecoded as an A/D result.

As illustrated in FIG. 4, the D/A function is produced by themicrocomputer U2 and a Custom Network R18. Two, four bit microcomputerports, R7 and R8 of the network R18 and pins 37-44 of the microcomputerU2 are utilized in tandem as an eight bit, binary up/down counter, whichdrive a standard eight bit, R/2R resistance ladder network 42 (FIG. 5)contained within network R18. Pin 3 of network R18 is the terminatingpin for the ladder network and pin 12 of network R18 is the analogueoutput pin. Pins 4-11 of network R18 are the eight input terminals tothe ladder network, with pin 4 of the network R18 being the leastsignificant bit (LSB) and pin 11 of network R18 being the mostsignificant bit (MSB).

Power to activate the A/D circuit 30 is derived from the -5 volt supply-VDD. Pin 32 of the microcomputer U2 provides the positive (+)connection and pin 53 of the microcomputer U2 and pin 3 of the networkR18 provide the negative (-) connections. The pins 37-44 of themicrocomputer U2 will either apply a logic 1 (0 VDC) or logic 0 (-5 VDC)connection to the eight input pins 4-11 of the network R18. The patternof 1's and 0's that are applied to the inputs of the network R18 are inthe form of either a binary up count or binary down count. The result ofthis action appears at the output pin 12 of the network R18. Starting atbinary 00000000, the voltage at pin 12 of the network R18 will be equalto the voltage of the -VDD supply. As the output pins 37-44 of themicrocomputer U2 count up, a positive going staircase waveform appearsat pin 12 of the network R18. With each count the voltage pin 12 of thenetwork R18 increases by -VDD/256. With a count of 11111111, the voltageat the pin 12 of the network R18 is maximum. This value is 255/256 ofthe -VDD supply. When a binary down count is applied, the sequence isreversed and the waveform at pin 12 of the network R18 becomes anegative going staircase waveform.

The output waveform of pin 12 of the network R18, 12 is conditioned byoperational amplifier U1 and applied to the RTD sensor 39 through seriesresistors R65, R20 and R19, and returned to circuit common throughresistor R15. This results in a varying voltage being applied to thesensor 39 rather than the conventional constant current excitation.

The RTD censor 39 is of such construction that the electrical resistanceof the sensor 39 increases as the temperature of the sensor 39increases, giving it a positive temperature coefficient. This resistancechange is very predictable and repeatable. Because of this, the voltageacross the sensor 39 is very predictable with a known current flowingthrough the sensor 39. By exciting the sensor 39 with a known, accuratecurrent, a known accurate voltage is developed across the sensor 39.This known, accurate voltage may be interpreted, using digitaltechniques, into a temperature indication. The reverse is also true, andforms the principle of operation of this circuit arrangement 30. When aknown voltage is applied, the current through the sensor 39 will be of aknown amount at any given temperature. In this case, a knownproportional voltage source, is produced by the microcomputer U2 and theCustom Circuit R18, and applied to the RTD sensor 39. This voltage isincreased until a predetermined proportional current level is achievedthrough the sensor 39. The voltage required to achieve thispre-determined current is directly proportional to the temperature ofthe RTD sensor 39. The temperature-resistance curve of the RTD sensor 39is such that for every unit change of temperature, there is a verynearly constant change of voltage at a given current level. By properchoice of current and voltage levels, a single unit increase intemperature will require exactly one additional binary count of voltageto achieve the same predetermined current level through the sensor 39.

The circuit arrangement 30 shown is set up to decode degrees Fahrenheitin 5° F. increments from -255° F. to +1055° F. The best choice of valuesfor the circuit components are dictated by the application requirementsIn addition, to cover this exceptionally wide range, software decodingmust compensate for whatever tracking error does exist between thesensor 39 and the D/A circuitry 30 if satisfactory results are to beachieved. In most applications, only a portion of this range isrequired, so satisfactory results are obtained over a limited rangewithout software compensation.

Basic circuit function consists of six phases which comprise aconversion cycle, the six phases being: Circuit Enable; Up Count ToCompare, Temperature Display and Controller Action; Down Count ToDiscompare; Error Check and Circuit Disable.

PHASE 1: CIRCUIT ENABLE

At the start of a conversion cycle, the circuit enable line 28 of themicrocomputer U2 is changed from a logic 1 to a logic 0, establishing avirtual ground equal to the -VDD supply at pin 11 of the op amp U1. Thepull-down resistor R21 assures that pin 5 of the op amp U1 is exactly at-VDD potential. This mandates that the (-) input at pin 6 of the op ampU1 is exactly at -VDD potential. This mandates that the (-) input at pin6 of the op amp U1 also be at virtual ground potential as controlled bythe output pin 7 of the op amp U1 through the 50 K ohms feedbackresistor R1 (FIG. 5) contained in the Custom Network R18 from pins 11 to12 thereof. Since the microcomputer U2 applies a binary count of00000000 to pins 4-11 of the network R18 at the start of this cycle,analogue output pin 12 of the network R18 is also at -VDD potential. Nocorrection voltage from the output pin 7 of the op amp U1 is required toestablish virtual ground potential at pin 6 of the op amp U1. Therefore,the output pin 7 of the op amp U1 also establishes itself at -VDDpotential. This in turn applies -VDD voltage potential to the seriescircuit of resistors R65, R20, R19, connector J2, interconnecting wires,the RTD sensor 39 and resistor R15. The resulting current causes avoltage to develop across the resistor R15.

Resistor R15 is a precision ±0.5% metal film resistor with a lowtemperature coefficient, indicating a stable resistance as the ambienttemperature changes. The voltage developed across this resistor R15 isrepresentative of the current flowing through it with great precision,and is monitored by the (-) input pin 9 of the operational amplifier U2,after passing through an impedance matching resistor R16. This voltageis compared against a proportional reference voltage derived from the-VDD supply by resistor divider network R19/R18 (FIG. 5) containedwithin the Custom Network R18, and brought out on pin 2 of the networkR18 which is connected to pin 10 of the op amp U1. This voltage is69.57%, ±0.5% of the -VDD supply, which equals -3.4785 volts when the-VDD supply is a nominal -5.0 VDC. The voltage will vary as the -5.0 VDCvaries, but in proportion to the D/A converter analogue output pin 12 ofnetwork R18 which also derives power from the -VDD supply. This factallows this circuit arrangement 30 to retain accuracy without the needfor expensive, highly stable power sources.

The reference voltage will always be more negative than the voltagedeveloped across resistor R15 at this point in the conversion cycle.Because of this, the output at pin 14 of the op amp U1 will also be in alogic low state due to its (+) input being more negative than its (-)input. Because operating power for the pin 11 of the operationalamplifier U1 is derived from the -VGG supply, the output will be atnearly -VGG potential, which is a nominal -15 VDC. This voltage reversebiases the series circuit of resistor R49 and diode D16 which is aspecial low reverse leakage diode attached to input pin 10 of the op ampU1. No effect is created at the input as a result of pin 8 of the op ampU1 being in the low state.

The initial conditions of the conversion cycle are therefore establishedas: Binary Count on pins 37-44 of the microcomputer U2 equals 00000000;Analogue output from pin 12 of network R18 equals -VDD; Output of pin 7of op amp U1 equals -VDD; Voltage across resistance R15 is more positivethan the reference voltage at pin 2 of the network R18; and Output ofpin 8 of the Comparator op amp U1 is logic 0.

PHASE 2: UP COUNT TO COMPARE

The current flowing through resistor R15 is dependent on two majorfactors. First the resistance of the RTD sensor 39, which varies withthe temperature of the sensor 39. Secondly, the voltage appearing at pin7 of the op amp U1. Resistors R19, R20 and R65 also affect the voltagedeveloped across resistor R15, but the effect is constant, with theirintended function being unrelated to the basic function of this circuit.This will be discussed later.

With the circuit initialized as described in Phase 1, the microcomputerU2 begins to count up in binary and toggle the eight output lines orpins 37-44 thereof accordingly. With each count, the voltage at analogueoutput pin 12 of the network R18 attempts to raise by an amount equal to-VDD/256 with each step. Due to the arrangement of the operationalamplifier U1, and the feedback resistor R1 (FIG. 5) internal to thenetwork R18, this attempt to raise the voltage of pin 12 of the networkR18 also causes an equal but opposite reaction from pin 7 of the op ampU1 with the net effect being no change of voltage at pin 12 of thenetwork R18. Instead, the mirror image of this voltage appears at pin 7of the op amp U1.

The characteristic output impedance of any R/2R network such ascontained in the network R18 is equal to R. With the resistance R1internal to the network R18 being chosen to equal the R value, in thiscase 50 K ohms, the op amp U1 is configured as a unit gain, invertingamplifier, referenced to -VDD. The output impedance of the network formsthe input impedance for pin 6 of the op amp U1 and the resistor R1,within the network R18, forms the feedback resistance. Because allresistors of this circuit are made from the same thick film ink, theratio of input to feedback resistance remains in the same ratio, eventhough the absolute values will change with time and temperature.Because of this, the long term gain accuracy of this device isanticipated as being very stable with no further adjustments required.

The net effect of this arrangement is that for every count up by themicrocomputer U2, an equal and opposite analogue voltage appears at pin7 of the op amp that starts at a voltage equal to -VDD and decreases inthe negative direction. At a binary input to pins 4-11 of the networkR18 of 11111111, the voltage at pin 7 of the op amp U1 will be -VDD+(255/256 (-VDD)). The full range of voltages at pin 7 of the op amp isnominally -5 to -5.98 VDC.

It is important to note that because the circuit maintains the analogueoutput pin 12 of the network R18 at virtual ground, the common modeinput range of the op amp U1 is never violated, even at very highoutputs from pin 12 of the network R18 that would normally exceed theacceptable input range of the op amp U1. In similar circuits notutilizing this arrangement, the usable range of the circuit would onlybe about 70% of the available output from pin 12 of the network R18.

As the voltage at pin 7 of the op amp U1 decreases (absolute valueincreases), an ever increasing amount of current begins to flow throughthe resistors R65, R20 and R19, the RTD, censor 39 and resistor R15. Asa result, the voltage across the resistor R15 becomes more and morenegative with each up count by the microcomputer U2. At some point, thevoltage developed across resistor R15 will become more negative than thereference voltage at pin 2 of the network R18. It is important to notethat because of the stable reference, this point will always be reachedat the same current level through the resistor R15 and the probecircuit. When this happens, the output pin 8 of the op amp U1 willrapidly switch from a logic 0 to a logic 1 state, with the pull-upresistor R17 assuring proper logic levels. In doing so, the feedbacknetwork of diode D16 and resistor R49 becomes forward biased, causing asmall amount of positive current to flow into the reference circuit ofpin 2 of the network R18. This small current causes the referencevoltage to shift a controlled amount in the positive direction,effectively making the volatage at resistor R15 appear to become evenmore negative with respect to the reference voltage. This controlledshift speeds the transition of pin 8 of the op amp U1 from the logic lowto the logic high state. The shift in the reference is also used toerror check the hardware and will be described later.

The output pin 8 of the op amp U1 is coupled to the input pin 24 of themicrocomputer U2 through buffer resistor R14. This input senses theinstant at which the transition of pin 8 of the op amp U1 from logic 0to 1 occurs. When this happens, the upward binary count of pins 37-44 ofthe microcomputer U2 is terminated under software control. This count isstored in a temporary memory register for later use in the conversioncycle. In this circuit, the count at the instant of transition will beunique with every 5° F. difference of the RTD temperature sensor 39 andmay be digitally processed. As the temperature, and therefore theresistance, of the sensor 39 increases, a higher binary count will berequired to cause the same current to flow through resistor R15. Thecircuit function is based on ramping to a predetermined current throughthe sensor 39, decoding the binary count required to produce thiscurrent, and then deriving a temperature indication based on a softwarealgorithm specific to the application. A higher binary number will equala higher temperature indication. Choice of circuit values will determinethe exact relationship.

PHASE 3: TEMPERATURE DISPLAY AND CONTROLLER ACTION

Once the unique binary count is obtained from phase 2 of the cycle, atemperature indication is derived by the microcomputer U2 and used bythe microcomputer U2 to place a visual indication in display 22, tocontrol a heat source, to sound an alarm, or to do whatever else theapplication requires. Before acting upon a single temperature reading,the software of the microcomputer U2 may also digitally filter the inputbefore further processing. Such software techniques will allow forbetter performance in electrically noisy environments or produce anaverage reading rom a rapidly changing sensor temperature.

PHASE 4: DOWN COUNT TO DISCOMPARE

After the software algorithm extracts the binary number required toachieve a logic high at pin 8 of the op amp U1 and decodes thetemperature, a second comparison is made. This second comparison is usedin phase 5 to determine if a hardware fault exists.

Rather than starting from a binary 00000000 and counting up in binary,the microcomputer U2 starts at a binary 11111111 and counts down for thesecond reading. This down count is terminated when pin 8 of the op ampU1 returns to a logic low state as sensed by the input pin 24 of themicrocomputer U2. The binary count required to produce a logic 0 at pit8 of the op amp U1 is compared to the count obtained in phase 2, whichrequired a logic 1. If the circuitry is functioning normally, the twocounts should compare within a range determined by the feedback circuitof the op amp U1, diode D16 and resistor R49, and the desiredsensitivity level of error checking that the application requires. Thedown count value will always be a lower binary number than the up countvalue if the circuit is working normally. The amount of inherentdifference is determined by the value of the resistor R49 and thestability of the incoming analogue voltage from the sensor 39. These tworeadings must be made within a very short time of one another to avoidactual changes in the sensor output from affecting this relationship. Inother words, the sensor 39 must appear to be of a constant temperaturebetween obtaining the up and down count values. The application willdictate the timings required.

PHASE 5: ERROR CHECKING

In the control unit 20 it was desired to cease operation if a hardwareerror was present that produced more than a 50° F. shift in temperatureregulation from the intended set point. The error checking was set asfollows.

The resistor R49 was chosen to produce a nominal 3 bit differencebetween the up count and down count values. This equates to a 15°difference in this application.

The software of the microcomputer U2 is programmed such that the downcount is subtracted from the up count and the result stored in temporarystorage. This number will typically be a 3 or a 4. This number is passedthrough an adjustable software filter, with the adjustments stored inthe non-volatile memory or EEPROM U3. Only numbers that are in the rangeof 2-9 are allowed to pass. If the difference does not fall into thisrange, a hardware fault is indicated, and action is taken to disconnectpower to the heat or cooling source as dictated by the application.

In addition to this fault detection scheme, two other conditions must bemet. In particular, the sensor 39 must not produce a logic high at pin 8of the op amp U1 when the binary input to the network R18 is 00000000.If it does, the sensor 39 is determined to be shorted and notfunctional. Operation is ceased. Also, the sensor 39 must produce alogic 1 on the output pin 8 of the op amp U1 prior to the microcomputerU2 outputing a value of 11111111 to the network R18. If it does not, thesensor 39 is determined to be open and not functional. Operation isceased.

The most frequest failure modes of the sensor 39 will be detected bythis scheme, whereas the most frequent failures of the A/D converter 30are detected by the up/down count comparison routine.

PHASE 6: CIRCUIT DISABLE

The cycle concludes after completing the previous 5 phases. The cycleterminates by removing power to the sensor 39 to minimize self-heatingeffects caused by power dissipation in the sensor 39 itself during theexcitation process. This is achieved by returning the enable line 28,R60of the microcomputer U2 to a logic high state, which also forces the pin5 of the op amp to a more positive value. The output pin 7 of the op ampis also forced high, essentially removing the excitation voltage to theseries circuit of resistors R65, R20 and R19, the RTD sensor 69 andresistor R15.

The duty cycle of on time to off time of the probe circuit is maintainedat a value suitable to the sensor 39 and the application in this manner.

The function of the resistors R19, R20 and R65 is three-fold. First,they provide a measure of current limiting in the event the RTD sensor39 is somehow shorted, for protection of output 7 of the op amp U1.Secondly they form a low pass filter in conjunction with the capacitorC6, which buffers against high frequency EMI/RFI disruptions. Third,they provide a means to intentionally offset the probe value withoutprogramming changes, by providing either a series resistance with theRTD sensor 39 or a parallel resistance across the resistor R19,intentional offset adjustments may be made. The value of the resistorsis such that if any single resistor shorts, the effect on thetemperature accuracy will be less than 50° F.

Calibration is done without potentiometers. The gain of the circuitrequires no adjustment due to the ratiometric nature of the circuit andlaser trimming of the resistors in the network R18 to a close ratiomatch. The primary adjustments are of an offset nature between thesensor circuit and the A/D circuit.

To calibrate, a special test mode contained in the microcomputer U2, notaccessible to the end user, is accessed. A precision resistor having aresistance value equal to the desired calibration temperature of the RTDsensor 39 replaces the RTD sensor 39 in the circuit. The test operatorthen instructs the microcomputer U2 through a keyboard, or other entryscheme, to accept the value of the precision resistor as a statedtemperature. The microcomputer U2 performs the up count portion of theconversion cycle, obtains the binary number that results, andpermanently stores in the non-volatile memory or EEPROM U3 the result.All temperature measurements after this point will be shifted such thatno error exists at the calibration point. Typical accuracy of ±3° F. areachievable over the range of 150° F., without further software orhardware compensation. If greater accuracy is desired, multiplecalibration points are possible.

The user interface circuit module or block 31 contains the rotary switch24 and eight momentary contact push buttons S1-S8. Appliance operationis programmed by the user through these switches. The rotary switch 24generates a signal that is fed through resistors R23 and R25 into therespective input pins 21 and 20 of the microcomputer U2. Resistors R22and R24 are pull-down resistors to -VDD so that 5 volt logic signals aregenerated. The microcomputer software decodes which direction the rotaryswitch 24 is being turned and increments or decrements the displayedreading in display 22 accordingly and in the manner fully set forth inthe aforementioned patents.

The eight momentary contact switches S1-S8 are used to select whichfunction the rotary switch 24 will program. Resistors R27 through R34are buffering/coupling resistors to the microcomputer U2 from theswitches S1-S8. Sip resistor R26 provides a pull down to -VDD for eachswitch S1-S8.

The function keys S8, S7 and S5 that result in oven operation Bake,Broil and Clean, also feed another circuit through respective isolationdiodes D13, D12 and D11. They will be hereinafter discussed in thesection on the watchdog circuit 37.

One unique key is the Cancel key S1. Because this design relies on thisswitch S1 to provide a reliable, single button cancel of oven operation,extra software monitoring of this key is provided. A strobe signal frompin 29 of the microcomputer U2 is applied to this key S1 through abuffering resistor R67. If the Cancel key S1 shorts, resistor R27 opens,the micro input or the strobe line fails, the AC signal normally presentat pin 48 of the microcomputer U2 will not be detectable by the softwareof the microcomputer U2. The result will be a failure alarm andappliance shutdown.

The remaining keys S2-S8 are monitored in the software of themicrocomputer U2 for short circuit conditions that could causeunattended appliance operation. Any key S2-S8 held down for more than 8seconds results in an error alarm similar to the Cancel key S1.

Diodes D8, D9, D10 are option diodes. When they are installed, adifferent controller option will be selected in software by the signalthat is coupled from the Cancel key strobe line to other microcomputerinputs. These options are installed at the time of manufacture and arenot user accessible.

The vacuum fluorescent display circuit 33 is the means by whichcontroller operating information is visually displayed by themicrocomputer U2. It consists of the display 22, resistors R35, R36, R37and R64, and diode Z3, in addition to the microcomputer U2.

The resistors R35, R36, R37 and R64 and zener diode Z3 are used toproperly bias the filament of the display 22. The content of displayedinformation depends on the microcomputer U2 which uses a conventionalmultiplexing scheme to drive the 8 grid by 9 segment display 22.

The EEPROM circuit 34 consists of the microcomputer U2, a decouplingcapacitor C8 and the EEPROM U3 which is a 16 by 16 bit device. Itprovides a means of storing various options that modify the standard,default feature set of the program stored in the microcomputer U2. Thecontrol unit 20 will operate without this device U3 installed accordingto the standard feature set. By installing the EEPROM U3, all aspects ofcontroller operation that are desirable to be adjustable, may becustomized for specific needs. In the area of temperature regulation,these adjustments are limited to ±35° F. each. In addition, upon powerloss, the time of day is saved, allowing the control unit 20 to powerback up with the time of power failure in the display. This mimicsmechanical clock operation.

The pin 1 of the EEPROM U3 is the chip select line thereof. Asynchronous clock signal generated by the microcomputer U2 is fed intopin 2 of the EEPROM U3. The pin 3 of the EEPROM U3 is the serialcommunication line for communicating to the device U3. The pin 4 of theEEPROM U3 is the data out serial port by which information is extractedfrom the EEPROM U3.

If the microcomputer U2 reads a consecutive string of all logic 1's or0's when reading the data out port, pin 4 of the EEPROM U3, the softwareof the microcomputer U2 assumes no options are required and the controlunit 20 operates according to a default set of operating parameters. Inthis manner, the failure of the EEPROM U3 does not radically affectappliance operation from a safety standpoint.

Even though the EEPROM U3 is capable of non-powered data retention for aminimum of 10 years without refresh, an added precaution is takenthrough software to assure that the initial options remain unchanged forthe life of the appliance. During the cool down period following a cleancycle, the microcomputer U2 first reads and then stores in RAM, all ofthe option information. It then performs a refresh cycle by writing theinformation just obtained, back into the EEPROM U3. This action issimilar to charging a rechargeable battery. In a normal usage situation,this will assure that the EEPROM U3 will not suffer data loss with time.It is expected that a clean cycle will occur at least a few times peryear. Data retention in this case need only be a few months rather than15 years, which is a typical oven's lifespan.

Other than time of day clock, and the user preference offset feature(which electronically simulates the movable pointer on a conventionalthermostat knob) the control unit 20 has no provision to changeinformation stored in the EEPROM U3 without the aid of an externalprogramming device.

The tone generator circuit block 35 contains a free running oscillatorU1 whose frequency is a nominal 2.45 KHZ. The oscillator U1 is fed to anamplification/buffering stage which directly drives a piezo-electricspeaker Y1.

In particular, resistors R38 and R42 form a voltage divider supplying50% of the -VGG voltage to the (+) input pin 3 of the op amp U1. This50% value is offset depending on the state of the op amp's output. Whenthe output is at a high level this 50% value is shifted by currentthrough a resistor R39 to about 20% of the supply voltage. When low,this value is shifted to about 85% of the supply voltage.

On the (-) input pin 2 of the op amp U1, a capacitor C9, a resistor R43and a diode D14 are connected. The other side of the capacitor C9connects to circuit common and the other side of the resistor R43connects to the op amp's output pin 1. When the output pin 1 of the opamp U1 is high, current is sourced through the resistor R43 to thecapacitor C9, which charges at a rate determined by the RC time constantof resistor R43 and capacitor C9. When the output at pin 1 of the op ampU1 is low, the capacitor C9 is discharged through resistor R43.Oscillation occurs because as soon as the difference in voltage betweencapacitor C9's charge and the power supply is less than the 20% valuementioned earlier for the (+) input at pin 3 of the op amp U1, the opamp output pin 1 changes to a low state which also changes the (+) inputvoltage to the 85% of supply condition. Now, capacitor C9 starts todischarge. When it reaches less than 15% of the supply voltage, itcauses the output to swing high again. An osciallation results.

The microcomputer U2 controls the tone duration by inhibitingoscillation. Pin 27 of the microcomputer U2 is coupled through diode D14to the oscillator U1. Since this output of the microcomputer U2 is a 5volt, CMOS output, the diode D14 performs two functions. First, itbuffers the output from the -15 volt swings of the op amp osscillatorU1. Secondly, it inhibits the charging of the capacitor C9 when themicrocomputer's output 27 is at a logic low. This stops the charging ofthe capacitor C9 with about 10 volts across it, which falls short of theupper voltage limit required to sustain oscillation. The op amp's outputpin 1 stays in a high state until the microcomputer's output pin 27 isset to a logic high, allowing the capacitor C9 to charge further andrestore oscillation.

The resistors R40, R41 and R62, transistor Q10, and piezo speaker Y1form the remainder of the tone generator circuit 35. The resistor R40couples the output of the oscillator op amp U1 to the base of transistorQ10 which is a PNP transistor. This transistor Q10 provides current gainand buffering from the oscillator U1 to the piezo speaker Y1. TransistorQ10 merely acts as a switch, allowing the speaker Y1 to charge throughresistor R62 and then discharging it from collector to emitter when thetransistor Q10 is biased on. The resistor R41, the base to emitterresistor, is intended to desensitize the circuit 35 slightly to preventlow level crosstalk from other circuits causing the speaker Y1 to buzz.

The oven interface block 31 comprises three outputs and a softwaresafety monitored input from the self clean door lock mechanism. Theoutputs are simple transistor drivers which activate external relays,which in turn, activate the oven bake and broil elements, plus a downdraft fan if required. The two outputs controlling the heating elementsmust pass current through the watchdog circuit 37 prior to relayenabling.

In particular, the pin 59 of the microcomputer U2 is the door lockstatus input. Because this input determines whether or not a clean cyclemay start, it was determined that component failures of the inputcircuit, or the input itself, must not allow a clean cycle if the ovendoor is unlocked. To achieve this, a technique similar to the cancel keymonitor was used. An A.C. signal, generated at pin 7 of themicrocomputer U2 and coupled to the door input pin 10 of strap J1 viatransistor circuit R48, R66, and Q5, must be detected during cleanoperation. If not, clean operation is not allowed. The logic of thisinput is that a continuous low reading is a non clean mode and thelimits of oven temperature are set accordingly. A clean mode requiresalternating high and low readings to remain valid.

From a failure analysis standpoint, substantially all failures of thiscircuit 31 will result in shut down of the clean cycle. The remainingcomponents in this circuit, resistors R44 and R45, and capacitor C10,must also be functional for the clean mode to be available. An externalswitch (not shown) is used to sense the position of the door lockmechanism.

The transistor Q4, resistors R46 and R47, and diode D15 form the bloweroutput circuit. This is a conventional inverting switching amplifierarrangement. When the microcomputer pin 6 goes to a logic high, thetransistor Q4 switches power from the -VR supply into an external relaycoil (not shown). The other side of this coil is attached to circuitcommon to complete the circuit. Diode D15 protects the transistor Q4from the inductive kick-back of the relay coil at turn off. The resistorR47 provides a measure of current limiting to protect the transistor Q4against damage from abusive service techniques that may involve shortingacross activated relay coils with a screwdriver to test the relay.

Transistor circuits Q6 and Q7 are the outputs for the respective Broiland Bake element relays (not shown). The arrangement is the same as forthe blower circuit with one major exception. Since any failure of thesecircuits in the "on" condition would result in uncontrolled ovenheating, redundant control of these drivers Q6 and Q7 is provided. Theemitters of these transistors Q7 and Q7 attach to another switchingdevice before a complete circuit to the -VR supply can be supplied tothe relays controlling the heating elements. The redundant switchingdevice is a transistor Q9 and is in the watchdog circuit 37 which ismonitored through software, and provides turn off of these outputs atthe limit points of 650° F. in bake, and 950° F. in clean as sensed bythe oven probe.

The heart of the safety logic is contained in the watchdog circuit 37.Its purpose is to supply redundant control of the heating elements byrequiring a mechanical key closure, S5, S7 or S8, prior to allowingpower to reach the relays that control the heating elements. Once acooking cycle has been initiated, an AC "keep alive" signal from themicrocomputer U2 is required to sustain cooking. This A.C. signal isonly generated if the microcomputer U2 is functioning sufficiently toregulate the oven temperature. In addition, the watchdog hardware ismonitored through software of the microcomputer U2 to assure that thecircuit 37 is functioning properly before allowing a heating mode tooccur. This monitoring is continuous, and will result in a failure alarmshould a fault be detected. Any single component fault of this circuitwill result in a safe shut down, with the user being required to repairthe fault prior to restoring use of the oven.

The Darlington transistor Q9 is the redundant controlling element inseries with the bake and broil relay driver transistors Q6 and Q7. Itmust be biased on prior to either of these relays receiving power. Inorder to turn transistor Q9 on, the following sequence must occur.

First, a function key (Bake S8, Broil S7, or Clean S5) must be pressedin the User Interface circuit 31 that is attached through isolationdiodes D11-D13 to the emitter of a level shift transistor Q8. This turnson transistor Q8, whose base is tied to -VDD through resistor R58. Whenthe transistor Q8 is turned on, current flows from circuit commonthrough the series path of the key S5, S7 or S8 being pressed, the diodeD11, D12 or D13 of that key, the emitter-collector junctions oftransistor Q8, through an isolation diode D22, and into the branchcircuit at the junction of resistors R59 and R60. Here, the currentsplits two ways, one path charging capacitor C12 from the -VR supply,and the other path causing sufficient current to flow into thebase-emitter junction of transistor Q9 and resistor R61 to causetransistor Q9 to switch on in a saturated mode from collector toemitter. The collector of transistor Q9, which is connected to theemitters of the Bake and Broil driver elements Q7 and Q6 is now allowingcurrent from the -VR supply to reach these drivers Q7 and Q6. This ineffect "enables" the drivers Q6 and Q6. This "enabling" does not turnrelays on until the drivers Q7 and Q6 are also instructed to do so bythe microcomputer U2 which occurs later in the sequence.

Secondly, the microcomputer U2 must recognize that a key S5, S7 or S8has been pressed in the User Interface circuit 31. Due to softwaredebounce, the function key S5, S7 or S8 must be held down long enoughfor the capacitor C12 to receive an adequate charge to keep transistorQ9 "on" upon release of the key S5, S7 or S8. If it is not held longenough, the microcomputer U2 simply ignores the key press and transistorQ9 turns off because the capacitor C12 discharges.

Assuming the key S5, S7 or S8 has been properly pressed, themicrocomputer U2 will decode it as an oven operating function and startits output pin 58 toggling at about a 120 HZ rate. This signal is ACcoupled through capacitor C11 and into the junction of diodes D20 andD21.

Since the output pin 58 of the microcomputer U2 is configured in themicrocomputer U2 to be only able to source current to circuit common,capacitor C11 is able to provide a "keep alive" current flowing intocapacitor C12, only if the transistor Q9 was on prior to the start ofthe AC signal. This is because a logic low on pin 58 of themicrocomputer U2 is only available if there is an external pull downresistance provided. The circuit is configured such that transistor Q9must be "on" prior to the pull down path being completed (through diodeD19 and resistor R56).

The logic high state of the pin 58 of the microcomputer U2 causescurrent to flow through the series circuit of resistor R57, capacitorC11, diode D20 and capacitor C12. Due to the relative values ofcapacitor C9 (0.47 mfd.) and capacitor C12 (47 mfd.), a single chargecycle will not produce sufficient voltage across capacitor C12 toenergize transistor Q9, unless several more closely spaced pulses occur.Since capacitor C12 was previously charged and transistor Q9 turned"on", (by a key press) a discharge path for capacitor C11 is providedwhen output pin 58 of the microcomputer U2 is set to a logic low state,through the path of resistor R57, diode D19, resistor R56, transistor Q9collector-emitter, and back through diode D21. This discharge cycleallows current to flow from capacitor C11 and capacitor C12 on the nexthigh transition of pin 58. A pumping action results that chargescapacitor C12 to an equilibrium value of about 14 VDC as long as the 120HZ signal remains present. This is sufficient to keep transistor Q9energized. If output pin 58 stops toggling in either a high or lowstate, the pumping action of capacitor C11 into capacitor C12 stops, andcapacitor C12 then discharges into resistors R60, R59 and R61, resultingin the transistor Q9 shutting off. This would require a key press beforethe transistor Q9 could once again be energized.

To insure that no hardware malfunctions have occurred that would causethe transistor Q9 to turn an without the proper key sequence andsustaining AC signal, a simple monitoring scheme is employed. Pin 18 ofthe microcomputer U2 is the watchdog monitor input. Through couplingresistor R54, pin 18 of the microcomputer U2 checks the state of thecollector of the transistor Q9 on a continuous basis. An alarm soundsand the relay driver outputs are inhibited if the collector of thetransistor Q9 is in the wrong state for the present operating mode ofthe control. For example, if the transistor Q9 is detected as being "on"for more than a few seconds in the absence of the AC keep alive signal,the alarm sounds and a characteristic failure code appears in thedisplay. Conversely, if the transistor Q9 is "off" during a legitimatecook or clean cycle, the alarm also sounds with another code beingdisplayed. This failure is not a safety concern, but the appliance willnot cook under this condition, so the user is notified.

There is one more area of monitoring performed by the microcomputer U2through the probe A/D scheme. Should a single component fault in thebake or broil relay driver circuits result in the microcomputer U2 beingunable to shut the relays off during temperature regulation, thetemperature in the oven will rise above the set point selected by theuser. When the temperature reaches the bake or clean temperature limits,the microcomputer U2 stops the sustaining A.C. signal for the watchdogcircuit 37, sounds an alarm, and displays an error code. The watchdogcircuit 37 shuts off, removing power to the relays in that manner.

Thus, the watchdog circuitry inhibits operation in the event of amicrocomputer failure and the microcomputer U2 protects against ahardware failure.

Thus, it can be seen that the watchdog circuitry 37 achieves thefollowing.

1. Prevents application of power to external relays unless a mechanicalkey closure has occurred. The microcomputer U2 alone cannot activate therelay circuitry. The proper key S5, S7 or S8 must by physically pressedprior to the microcomputer U2 having control. In this manner, the systembeing controlled by this circuit 37 will not receive power unless theoperator is present. This greatly minimizes the likelihood of anundesired operating mode being sustained for long periods of time. Inthe case of an oven being controlled by this circuit 37, the stove willnot self start a bake, broil, or clean cycle and possibly exceedacceptable interior temperatures due to sustained heating elementoperation without regulation.

2. A single component failure will not result in the system selfstarting. The hardware guards against microcomputer U2 failures, whilethe microcomputer U2 guards against hardware failures. This is achievedthrough a unique feedback arrangement under software control.

3. Through software monitoring, any component failure that could resultin the oven self starting should a second component fail, disables thesystem until repairs are made. This is achieved through audible andvisual alarms that act as both a diagnostic tool to aid repair and as adeterrent to use the system in a marginally functional state.

4. Once started, the microcomputer U2 monitors its own inputs and willshut off the system should critical inputs fail in a manner that wouldprevent the operator from having control of operation through whateverinput means is provided. (Keys, rotary switch, sensors, etc.)

5. A dynamic signal is required from the microcomputer U2 to sustainwatchdog circuit operation. This signal is generated only if the variousconditions being monitored in software are logically correct.Significant component failures during operation will result in systemdisabling.

6. Failures of external components such as power relays which provideswitching for the heat or cooling sources are also monitored. An alarmwill sound and a unique visual display presented if the temperaturebeing sensed through the temperature sensor 39 does not agree with theset temperature within a predetermined tolerance. The operator may thenintervene and shut down the system.

7. No comparator is required to achieve this function as in priorcircuits.

8. The circuit 37 may be designed to have a controlled turn-on and turnoff time through inexpensive value changes. As an example, during powerinterruptions, the hardware will sustain enabling of the relay outputsfor a controlled period of time. In this manner, brief powerinterruptions will not result in shut down of the system beingcontrolled. This eliminates one of the most undesirable traits of manyelectronic control systems, which is the need to reprogram during commonpower dips of less than 5 seconds.

The basic operating principle of the watchdog circuit 37 is verystraightforward. Transistor Q9, a 2N5308 or similar darlingtontransistor, and supporting circuitry, is used as an enabling switch thatallows application of power to the relay driver transistors Q6 and Q7.Without transistor Q9 enabled, the external relays cannot turn on, evenif the driver transistors Q6 and Q7 are on. Transistor Q9 is in serieswith the power source for the relay driver transistors Q6 and Q7.

The logic involved in keeping transistor Q9 enabled is not asstraightforward. An A.C. signal must be generated at pin 58 of themicrocomputer U2 to sustain the enabled state. This A.C. signal isgenerated only if predetermined logic conditions are met that involvemany other circuits. This logic is controlled through the ROM softwareprogram stored in the microcomputer U2.

In order to describe the circuit function, it is first assumed that alllogic conditions necessary to sustain the A.C. signal at pin 58 of themicrocomputer U2 are being met and therefore the sequence to properlyenable transistor Q9 is as follows.

A function key S5, S7 or S8 must be pressed that is coupled to thecircuit through isolation diodes D11-D13. The watchdog monitor input pin18 of the microcomputer U2 must be at a logic 1 state indicating thattransistor Q9 is disabled (off). And the temperature sensor 39 must beindicating an acceptable starting temperature.

The only keys that may enable the watchdog transistor Q9 are the Bake,Broil, and Clean keys S8, S7 and S5. These keys have the isolationdiodes connecting the key to the emitter of level shift transistor Q8.Pressing any one of these keys simultaneously applies a logic one to themicrocomputer input associated with the function key, and causes currentto flow in the base-emitter junction of transistor Q8.

For example when the Bake key S8 is pressed, the pin 33 of themicrocomputer U2 is connected to circuit common through bufferingresistor R34, placing a logic 1 on this input. Microcomputer U2 proceedsto check all monitored logic and if acceptable, starts to outputalternating logic 1 and 0's at pin 58 of the microcomputer U2 atapproximately a 120 hz rate. Simultaneously, the transistor Q8 circuitcauses current to flow from the 27 volt, -VR power supply, through theseries path of the Bake key S8, diode D13, transistor Q8 collector toemitter, diode D22, resistor R60, and capacitor C12. Capacitor C12charges at a rapid rate as determined by the time constant of resistorR60 and capacitor C12. During the time the key S8 is pressed, transistorQ9 is enabled (collector of transistor Q9 at -VR potential) through theseries path of diode D12, transistor Q8 collector to emitter, diode D22,resistor R59, and through the base to emitter junction of transistor Q9to the -VR supply. Resistor R61 is the base to emitter resistor fortransistor Q9 and insures that a controlled amount of current must flowthrough resistor R59 before the required 1.4 volts is developed acrossthe transistor Q9 base to emitter junction required to enable transistorQ9. After the bake key S8 is released, transistor Q9 remains enabled dueto two factors. The first factor is the charge impressed acrosscapacitor C12 during the key press action. Depending on the duration ofthe key press, a substantial voltage will be impressed across capacitorC12. This voltage is divided down and appears across the transistor Q9base to emitter junction through the voltage divider of resistors R60,R59 and R61, allowing transistor Q9 to remain enabled even after the keyS8 is released. The capacitor C12 voltage begins to decay at a rateestablished by the time constant of resistors R60, R59, and to a lesserextent, resistor R61. When the charge across capacitor C12 decays toabout 4.5 volts, transistor Q9 will again turn off. By varying the valueof this time constant, transistor Q9 will continue to remain enabled forthe desired period after removal of all sustaining input signals. Theminimum requirement for the key press is approximately 50 millisecondsfor proper circuit operation. The inherent closure time for a manuallyoperated switch generally assures this duration, but if the switch isintentionally pressed for a very brief duration, the input pin 33 of themicrocomputer U2 will not recognize that a valid key press has occurred,forcing the operator to repress the key to gain access to the function.This action again charges capacitor C12, assuring sufficient voltage isavailable to sustain circuit operation. Transistor Q9 will return to thedisabled state unless the charge on capacitor C12 is reinforced at afaster rate than the discharge rate of resistors R60, R59 and R61. Thesecond factor to sustain operation is the 120 hz signal generated by themicrocomputer U2 at its output pin 58 and coupled to capacitor C12through current limiting resistor R57 and coupling capacitor C11. When alogic 1 is output to pin 58 of microcomputer U2 current flows from pin32 of microcomputer U2 through a FET transistor channel internal to themicrocomputer U2, to pin 58 of the microcomputer U2 through resistorR57, capacitor C11, diode D20, and into capacitor C12. Due to therelative values of capacitors C11 and C12, an individual charge cycleonly imparts about 0.3 of a volt additional charge to capacitor C12.This value varies depending on the voltage across capacitor C12, and thevoltage of the -VR supply. Output pin 58 of the microcomputer U2 is ableto source current to circuit common only, having only a FET channelconnected to circuit common at pin 32 of microcomputer U2. A pull-downresistance is needed for the output to generate a logic 0. Thispull-down resistance path is provided external to the microcomputer U2,through the path of diode D19, resistor R56, and the collector toemitter junction of transistor Q9. This mandates that transistor Q9 mustfirst be enabled before pin 58 of microcomputer U2 can generate a logic0 output. This fact is the basis on which the self-start logicprotection is based. The watchdog circuit 37 must have an AC signal frompin 58 of the microcomputer U2 to sustain the enabled state oftransistor Q9. The AC signal cannot be generated unless transistor Q9 isfirst enabled. The only way to do this without the AC signal is bypressing a function key and energizing transistor Q8, which in turnenergizes transistor Q9. When pin 58 of the microcomputer U2 isinstructed by software to output a logic 0, and transistor Q9 is on, adischarge path is provided for capacitor C11 through resistor R57, diodeD19, resistor R56, transistor Q9 collector to emitter, and diode D21.Due to the relatively small value of capacitor C11, the capacitor C11 isnearly fully discharged prior to the next logic 1 output from pin 58 ofthe microcomputer U2 which allows additional current to flow intocapacitor C12 with every return to logic 1 of pin 58 of themicrocomputer U2. Capacitor C12 also discharges, but can only dischargeinto the transistor Q9 base to emitter circuit due to the blockingaction of diodes D20 and D22. This path has a relatively long timeconstant. The amount capacitor C12 discharges is less than the amountcapacitor C11 charged it on the previous positive going cycle of pin 58of the microcomputer U2. As the 120 Hz AC signal continues out of pin 58of the microcomputer U2, capacitor C11 gradually pumps up the voltageacross capacitor C12. This voltage is approximately 14 VDC in thiscircuit arrangement and is the point at which the charging action ofcapacitor C11 into capacitor C12 exactly equals the discharge ofcapacitor C12 into the transistor Q9 base to emitter circuit. As long asthe AC signal is present, the pumping action continues. If themicrocomputer output remains in either logic state for an extendedperiod of time, capacitor C12 will discharge, and transistor Q9 willbecome disabled when the voltage across capacitor C12 falls below about4.5 VDC.

It is important to note that a single charge cycle of capacitor C11 intocapacitor C12 cannot enable transistor Q9. If the microcomputer were tooutput the AC signal from its pin 58, without a key S5, S7 or S8 beingpressed, capacitor C11 would become charged on the transition from logic0 to logic 1. Since a single charge cycle does not impress enoughvoltage across a fully discharged capacitor C12 to enable transistor Q9,no pull down path is provided for pin 58 of the microcomputer U2. Itwill be unable to discharge capacitor C11 on the transition from logic 1to logic 0 due to the incomplete discharge path. As a result, verylittle current flows on consecutive cycles of the AC signal. CapacitorC12 will not charge further, and transistor Q9 will remain disabled, notallowing power to reach external relays.

The logic state of the collector of transistor Q9 is continuouslymonitored by input pin 18 of the microcomputer U2 through bufferresistor R54. The software algorithm contained in microcomputer U2 issuch that if the state of the collector of transistor Q9 isinappropriate for the present operating condition of the control, ahardware malfunction is assumed and a visual/audible alarm is generated.Basically the input must see a logic 1 during output off modes, andconversely must see a logic 0 for output on modes. Any failure of thewatchdog components that either cause transistor Q9 to be in aninappropriately enabled or disabled state will cause the microcomputerU2 to inhibit the relay driver transistors Q7 and Q8. In this manner,single component failures will not cause self start of the relayoutputs. In addition, the alarm will provide incentive to seek repair ofthe fault.

As mentioned previously, several circuits are monitored and must provelogically correct, or the AC signal generated at pin 58 of themicrocomputer U2 will be inhibited under software control.

In particular, the real time 60 Hz reference signal at input pin 23 ofthe microcomputer U2 must be of a continuous nature. If no transitionsare detected after 16 completions of the display update cycle, thesignal stops. This protects against run on during operation of heat/coolfunctions due to lack of a timing signal. The cancel key input pin 48 ofthe microcomputer U2 must continue to see an AC signal generated byoutput pin 29 of the microcomputer U2 to sustain watchdog operation.Lack of this signal indicates the possible inability to sense the Cancelkey S1 being pressed, which is the prime input for aborting activefunctions. The error detecting circuitry of the A/D converter 30 must besuccessfully producing an error free check of the A/D hardware. Errorsof this circuit would not allow the control to properly maintaintemperature so operation is ceased by disabling the watchdog. Duringclean modes in which very high temperatures are reached, the oven cavitydoor must remain locked to protect the user. Door lock input pin 59 ofthe microcomputer U2 must continue to see an AC signal generated by doorstrobe circuit transistor Q5 or the input is faulty. Any fault in thiscircuit would possibly prevent an accurate indication as to whether theoven door is locked. Clean mode operation is inhibited if this circuitmalfunctions, also disabling the watchdog circuit. These types of errorchecks can be expanded for any application. Any critical circuitfunction that fails will result in the AC signal from output pin 58 ofthe microcomputer U2 being disabled.

Parameters that dictate the operation of BAKE, BROIL, and CLEAN mode arenominally programmed in the ROM memory of the single chip microcomputerU2. The EEPROM U3 stores values that offset these parameters. It ispossible to operate the control unit 20 in an oven without the EEPROMU3. The EEPROM values are retained indefinitely when all power isremoved which lends itself to the tailoring of a generic control to aparticular customer's needs in short turn around time.

Values stored in the EEPROM U3 can only cause offsets to a maximum ofplus/minus 35° F. when used with the control unit 20 of this invention,the usage of the non-volatile EEPROM memory is to retain operatingparameters of the control unit 20 through software.

1. Bake mode parameters--relay on/off temperatures

The ability to form specific relay on and off temperatures for a chosencook temperature gives the ability to mimic any control system presentlyin use. It has been found that the control unit 20 can perform asreplacement of, as well as surpass the performance of, mechanicalthermostats.

A set temperature (T-set) chosen by the user from the rotary dial 24 asviewed in the red VFD digits of the display 22 will fall into either anUpper band or Lower band. The lower band is a range from the lower entrylimit (170 nominal) to the Band Break point (300 nominal). The upperband is a range from the Band break to the upper entry limit (550nominal). (FIG. 8) Two bands are desirable for optimal compensating ofoven cavity losses at high temperatures vs. low temperatures whileholding a precise temperature swing at lower temperatures.

When the bake mode starts, the EEPROM U3 is read and offsets apply toT-set to form T-set' which is compensation for center of oven to thesensor position. Optimally, the center cavity temperature is to becontrolled to the T-set. The sensor is usually mounted off to a cornerwhich causes gradients. Since these gradients are different betweenlower temperatures and higher ones, a T-set'H and T-set'L offset is used(FIG. 9).

Actual control of the heating element relays is done by comparing the Ato D output temperature (T-act) inside the microcomputer U2 to T-on andT-off temperatures. These are formed by offsetting T-set' with separateEEPROM offset values for upper or lower band (FIG. 9). Relay energizeswhen T-act is less than T-on, deenergizes when T-act is greater thanT-off. If T-on and T-off are spread, there will be hysterisis to preventrapid relay switching which shortens its life as well as obtaining apredictable temperature envelope.

2. Bake mode parameters -Relay duty cycling

Further precise control of temperature swing can be obtained by timeduty cycling the heating element relays when calling for heat. The relaycan be cycled in percentages controllable by varying on and off times in1 second steps. These on/off times are stored in the EEPROM U3 and areformatted such that with an EEPROM fault or no EEPROM, on time is 100%.

3. Bake mode parameters--quarter top heat (QTH).

In many oven applications, more even and quicker heating can be obtainedby implementing the broil (top) element as well as the bake (lower)element. In electromechanical oven systems, this is often done byapplying quarter power to the broil element by applying 120 volts acrossa normally 240 volt operated element through a relay/mode switcharrangement. In the control unit 20, QTH is implemented by time dutycycling 240 volts to the broil element 25% (usually 15 sec on/45 secoff). Choosing QTH option as well as broadening the range for anypercentage is implemented with stored values in the EEPROM U3.

4. Bake mode parameters--First rise compensation

When a cold oven is activated for cooking, a large overshoot occursafter the set temperature is reached for the first time. This is duelargely to the lagging effect of the sensor envelope mass.

To control this overshoot, a special first rise T-off temperature(T-offFR) is calculated as follows: if a new T-set is chosen that is 50or more degrees higher than the present oven temperature (T-act) T-offFRwill be used. Depending on which band the chosen T-set is in, adifferent factor for T-offFR is used.

In operation, when T-offFR is reached, the heating element(s) deactivateand a timer is started which tracks the coasting of the heater air intothe desired control temperature band. When T-set is reached or the timertimes out, normal T-on and T-off are reinstated and normal oven controloccurs thereafter.

Values for determining T-offFR-Hi and T-offFR-Lo, offsetting the 50°difference comparing value (Hi and Lo bands), the coast timer are allstored in the EEPROM U3 (FIG. 10.)

5. Broil mode parameters.

Similar to bake, broil elements can be thermostatically controlled andtime duty cycled separately. Relative multi-step user selectable broilsettings can be implemented such as "LO-1-2-3-4-5-HI".

Typically, broil is executed with the oven door open which prevents aT-off from ever being reached. To reduce the power applied, therefore,the element on-time percentage is reduced for lower settings. T-off andT-on temperatures are also used in case the door is closed and are nottypically user selectable. (FIG. 7)

This multi-step format is suited for electric ovens. For gasapplications, time duty cycling does not lend itself due tounpredictable ignition times, therefore only one broil setting isdesirable.

Values for on-times for each step, T-on and T-off offsets up toplus/minus 35°, how many steps or one step selection are all stored inthe EEPROM U3 such that they offset nominals in the ROM of themicrocomputer U2.

6. Clean mode parameters.

Clean operation cycle format can be arranged by choosing options andvalues to be stored in the EEPROM U3. Much flexibility is available tomatch any oven configuration.

A user selects a clean duration from the front panel. Limits for theduration are EEPROM settable. A fixed duration may be implemented.Typical durations are two to four hours.

The cycle is arranged in up to 3 timed stages not apparent to the user.One of the two oven heating elements is the primary for a given stagewith the secondary element off or time duty cycled. The first two stagesare typically heating cycles with the third being a cool down time.

Values for the stage durations, which elements are used, duty cycletimes, clean T-on and T-off temperatures, number of stages are allstored in the EEPROM U3.

Clean temperatures are high enough such that locking the door isrequired. Door lock status is indicated to the user with an annunciatoron the front panel. The temperatures where the annunciator goes on andoff are stored in the EEPROM U3 and set to correlate to a thermalmechanical latch without any connection to it. (FIG. 6)

7. Time of day clock retention

A typical oven control includes a time-of-day clock user feature. Amechanical clock freezes at its setting when power is removed.Electronic clocks loose the setting and return to a consistent presettime. Mechanical clocks have the advantage to the user in cases of shortpower losses where negligible amounts of time are lost.

The electronic clock can realize this advantage if the time digits arestored in the EEPROM U3 at the first sign of power loss. Upon powerrestoration, the stored digits are read, displayed and used. In thisway, the mechanical system performance is duplicated and surpassedbecause the digits can flash at power up to indicate time was lost.

Power loss is detected by sensing the loss of an incoming 60 Hz powerline signal. When line power is lost, enough DC power is stored in powersupply capacitors to support the microcomputer U2 for several secondswhile the present time digits are stored.

8. Control integrity

The EEPROM U3 can be used to support the overall quality of the controlunit 20.

Support of redundancy/backup circuits described elsewhere isaccomplished by storing values for hi temperature alarm thresholds.Standards require backup temperatures that give a shutdown and userapparent alarm when reached. These thresholds are stored in the EEPROMU3 and are changeable to track changeable T-set values for the variousmodes. (FIGS. 6-8).

At time of manufacture, the A to D circuitry 30 is calibrated to offsetcomponent tolerances. An offset value is stored in the EEPROM U3 in lieuof a more typical potentiometer adjustment. The offset procedureincludes limits of 35°.

Also at time of manufacture or field service, a check can be made of allimportant EEPROM values through a procedure known as checksum. Allpermanent EEPROM values are added together and the least significant twodigits of the sum are displayed for test comparison. If no match isseen, it is assumed the EEPROM data is bad and must be reprogrammed orreplaced. Statistically, this method catches a very high percentage offaults.

9. Changing EEPROM data in-circuits

A program is included in the software of the microcomputer U2 for thecontrol unit 20 that allows access to all EEPROM locations in their rawformat using front panel display and keys. This program is not availableto the consumer and is accessed through a user unknown method. Theprogram can read and write all locations of the EEPROM U3.

An alternate method of in-circuit programming is via an externallyconnected computer. Typically, the external computer interface isconnected in place of the keyboard of the control unit 20 and data canbe read and written through the connector of the microcomputer U2 to andfrom the EEPROM U3.

The external method is useful for "off the shelf" tailoring of controlsfor quick turn around manufacturing testing and secure field accessing(must have the external computer).

While FIGS. 4A-4D of the drawings show certain values for the variouselectrical components of one working embodiment of this invention, it isto be understood that other values could be utilized if desired.Nevertheless, in FIGS. 4A-4D, unless otherwise noted, all diodes areIN4004, all capacitance values are in microfarods, 50 V, 20% and allresistance values are in ohms, 0.25 W, 5%.

A method of utilizing the power of the microcomputer U2 to aid in userconvenience or friendliness is provided by the control unit 20. Not onlycan the microcomputer U2 sort out and track the necessary timers andtemperature controls, the microcomputer U2, through its software, can beprogrammed to do certain calculations as an aid to user programming.

No. 1--Rotary Dial Usage

The control unit 20 uses a rotary dial 24 as a means for entering data.Other typical electronic controls use a 10-digit key pad. The use of thedial 24 allows instantaneous entry limit checking allowing the userinstant entry of valid digits. With the prior known key pad, any digitsmay be entered and are normally evaluated with a subsequent key actionresulting in two or more steps. If erroneous data has been entered theuser will have to start over. The dial 24 clearly has the advantage.Programming and oven cook duration is a feature of the control unit 20of this invention utilizing the instant entry scheme provided by therotary selector 24 and when the cook duration times out, the ovenheating elements are deenergized and the user is notified with a beep.

No. 2--Oven Time

A user may choose to think of cook duration in terms of a length oftime. If this is the case, the user may use the rotary dial 24 to enteroven time in terms of hours and minutes length starting now as a time ofentry. The control unit 20 will then regulate the oven to a selected settemperature for this duration.

No. 3--Stop Time

The user may choose to think of cook duration in terms of the time ofday now which is at a time of programming until some later time of day.If this is the case the user may enter a stop time in terms of time ofday with the rotary selector 24.

No. 4--Priority Scheme

If an oven time is programmed, the microcomputer U2 will generate a stoptime on its own. This time is available for user review and changing asdesired. Changes to the generated stop time are limited such that theprogrammed oven time is not shortened. This is considered oven timepriority. If a stop time is programmed, the microcomputer U2 willgenerate an oven time on its own. This time is available for user reviewand changing as desired. Changes to the generated oven time are limitedsuch that the program stop time is not moved to a later point. This isconsidered stop time priority.

No. 5--Programming a Delay

A delay until cooking starts may be programmed by the user of thecontrol unit 20 if desired. Delayed programming is an enhancement ofoven time or stop time programming and follows either chosen program. Ifthat oven time is programmed, the generated stop time may be recalledand advanced. This action advances the block of oven time such that itends at the chosen stop time. If a stop time is programmed the generatedoven time may be recalled and shortened. This action decreases the blockof oven time such that it ends at the programmed stop time.

Thus, it can be seen that this invention provides a new control unit anda new method of making such a control unit.

While the forms and methods of this invention now preferred have beenillustrated and described as required by the Patent Statute, it is to beunderstood that other forms and method steps can be utilized and stillfall within the scope of the appended claims wherein each claim setsforth what is believed to be known in each claim prior to this inventionin the portion of each claim that is disposed before the terms "theimprovement" and sets forth what is believed to be new in each claimaccording to this invention in the portion of each claim that isdisposed after the terms "the improvement" whereby it is believed thateach claim sets forth a novel, useful and unobvious invention within thepurview of the Patent Statute.

What is claimed is:
 1. In a control system comprising a high energycontrol circuit means having an output relay driver transistor, manuallyoperated means for initiating the operation of said high energy controlcircuit means, microcomputer means for operating the high energy controlcircuit means after said manually operated means has initiated theoperation thereof, and supervisory circuit means for detecting failureof said system and disabling said high energy control circuit means ifsaid system is not operating in a normal mode thereof, said supervisorycircuit means having means requiring the manual operation of saidmanually operated means before permitting power to reach said highenergy control circuit means whereby said high energy control circuitmeans is disabled unless said manual operation of said manually operatedmeans has taken place and said system is operating in said normal modethereof, said supervisory circuit means having a supervisory transistortherein that is in series with said relay driver transistor and thatmust be switched on to enable said relay driver transistor, theimprovement wherein said supervisory circuit means has capacitor thereinfor sustaining the on condition of said supervisory transistor, saidmanually operated means comprising momentary means for initiallycharging said capacitor and switching on said supervisory transistorwhen said manually operated means has been manually and momentarilyoperated to initiate the operation of said high energy control circuitmeans, said system having means for continuing the charging of saidcapacitor only after the initial manual and momentary operation of saidmanually operated means has initially charged said capacitor and if saidsystem is operating in a normal mode thereof.
 2. A control system as setforth in claim 1 wherein said means for continuing the charging of saidcapacitor comprises AC coupling means.
 3. A control system as set forthin claim 2 wherein said means for initially charging said capacitorcomprises a transistor that is temporarily switched on by the manual andmomentary operation of said manually operated means.
 4. A control systemas set forth in claim 1 wherein said high energy control circuit hasanother output relay driver transistor that is also in series with saidsupervisory transistor and in parallel with the first-mentioned outputrelay drive transistor.
 5. A control system as set forth in claim 4wherein said manually operated means comprises a plurality of electricalswitch means respectively operatively associated with said output relaydrive transistors through said microcomputer.
 6. A control system as setforth in claim 1 wherein said control system is adapted to be a cookingapparatus control system and said output relay driver transistor isadapted to operate a heating element means of the oven of such cookingapparatus.